Coldframe, an open-source project from hedgerow-dev, imitates supermarket refrigeration controllers so defenders can record attempted intrusions against a decoy. GitHub records its repository creation on November 5, 2026. Its documentation describes simulated Danfoss and Dixell systems that accept selected logins and record subsequent actions. That gives researchers a way to distinguish a connection attempt from someone trying to operate the simulated equipment.
This is a documentation-based assessment of commit 7b213ad. MrKeyoor hasn't run the honeypot or verified its interface against physical controllers. The repository date establishes when the project appeared on GitHub, not when each capability was implemented.
Why the management interface matters
In research published August 9, Claroty Team82 described finding thousands of publicly accessible Danfoss AK-SM 800A management interfaces. These systems coordinate refrigeration equipment and let administrators change settings through a browser. Exposure can put operational controls within reach of a remote attacker.
Team82 reverse engineered a hidden daily-code authentication path that could bypass the administrator's password. It also reported command injection and web-server configuration flaws. According to its disclosure account, Danfoss released firmware R4.3.1 to address the reported vulnerabilities. Team82 recommends keeping management interfaces off the public internet. A decoy doesn't remove that obligation for real equipment.
What the logs can tell you
The Coldframe README separates credential attempts from actions taken after login. A simulated defrost request becomes a control event. Matching exploit requests receive a separate label, and optional Modbus support is disabled by default.
That separation gives an analyst a useful question to ask of collected traffic: did a visitor stop at authentication, or continue toward a control action? A matching request alone cannot establish an attacker's identity or prove that the same technique compromised a real installation.
Recognizable responses limit the experiment
The project's limitations say its simulation is shallow and some undocumented device responses use plausible values. Public code also lets visitors recognize the decoy. These limits matter when interpreting silence: an attacker who identifies the imitation may leave before producing a control event.
The next useful evidence would be deployment results that disclose collection periods and how scanner traffic was classified. Until then, Coldframe's documentation supports evaluating its collection design; it doesn't establish how often real refrigeration systems are attacked or compromised.